BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT
Data Protection Authority of Bavaria for the Private Sector
________________________________________________________________________________________________________
24.05.2024
Final Decision
Complaint by against the company dated 28.03.2022 (IMI Notifica-
tion Nr.: 425325; File number of the Data Protection Authority of Bavaria for the Private Sector:
LDA-1085.3-2905/22-I)
In the above matter, the Data Protection Authority of Bavaria for the Private Sector (BayLDA) issues the
following decision pursuant to Art. 60 (8) GDPR on the basis of the draft decision of the Dutch supervisory
authority (Autoriteit Persoonsgegevens) of April 18, 2024:
The complaint by against dated 28.03.2022 is rejected.
Justification:
I. Facts of the case
After the BayLDA received 's complaint, it was prepared for forwarding to the lead Dutch super-
visory authority via IMI and transferred there.
In her complaint, the complainant stated that she had repeatedly requested the deletion of her customer
account and her personal data via the contact form provided by the company on its website, but that the
attempts to contact the company had been unsuccessful on each instance.
After an internet search for the company revealed a registered office in the Netherlands (
), the complaint was forwarded there on the assump-
tion that the Dutch supervisory authority had responsibility.
After the Dutch supervisory authority pointed out that a "preliminary vetting" had to be carried out in ad-
vance, the BayLDA wrote directly to the company at the address provided (
) on December 15, 2022 and January 31, 2023. However, the letters remained unans-
wered.
After the "preliminary vetting" had thus been carried out without success, the Dutch supervisory authority,
as the lead supervisory authority, carried out further investigations and announced this on 12.10.2023:
“The NL SA has tried to investigate the case of . We sent an e-mail to the controller on 23rd of May
2023 at , to which no reply was received.
Next, we sent two registered letters, one to the address at which the company is registered (
) on June 11th 2023 and one to the address that is mentioned in the general terms and conditions
on the website ( ) on August 2nd 2023. The first letter was not received and returned
to the NL SA. The second letter was received but not answered.
Next, on October 27th 2023, we paid a visit to both addresses. At the , the door was not answered.
At the , it wasn’t either but there was a sign on the door indicating the name of another company, called
. We telephoned and the owner of this company told us that had copied
’ general terms and conditions without permission, including ’ address, and this was
...
-2-
causing some problems for . is in fact not located at the . The owner of
had in fact received our letter, but did not know what to do with it and had left it at that.
There are no further leads to investigate this case.”
II. Legal assessment
The Dutch supervisory authority describes that any attempt to contact the controller to request a statement
on the specific complaint and to support the complainant in exercising her right to erasure of personal data
pursuant to Art. 17 GDPR has been unsuccessful.
There was no response to contact attempts by email or post, nor could it be confirmed during personal vi-
sits to the addresses identified that the controller's registered office was actually located there.
According to the Dutch supervisory authority, all investigation options there have been exhausted.
The Dutch supervisory authority sees itself forced to close the specific complaint case, regardless of whe-
ther the complainant's request for erasure is justified under Art. 17 GDPR or not.
As the lead supervisory authority, the Dutch supervisory authority has therefore come to the decision that a
claim for erasure cannot be exercised or enforced according to the results of the investigation, as the con-
troller cannot be contacted and the complaint can therefore not be pursued further.
As the supervisory authorities concerned have not raised any objections to the present draft decision, the
BayLDA hereby issues the present decision within the meaning of Art. 60 (8) GDPR
Ansbach, 24.05.2024
Data Protection Authority of Bavaria for the Private Sector